ciplink 0.1.0__py3-none-any.whl

ciplink/__init__.py

@@ -0,0 +1,40 @@
+# -*- coding: utf-8 -*-
+#
+# Copyright (c) 2021 Ian Ottoway <ian@ottoway.dev>
+# Copyright (c) 2014 Agostino Ruscito <ruscito@gmail.com>
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+#
+
+from ._version import __version__, __version_info__
+from .logger import *
+from .const import *
+from .tag import Tag
+from .exceptions import *
+from .cip import *
+from .custom_types import *
+from .cip_driver import *
+from .logix_auth import LogixMetadataCredentials
+from .logix_driver import *
+from .slc_driver import *
+
+from types import ModuleType as _ModuleType
+
+# export everything above except the submodules, so `from ciplink import *` does not shadow map, logger, etc.
+__all__ = [n for n, v in list(globals().items()) if not n.startswith('_') and not isinstance(v, _ModuleType)]

ciplink/_logix_bundle_codec.py

@@ -0,0 +1,108 @@
+"""Local credential bundling with RFC 8439 ChaCha20-Poly1305.
+
+Only the Python standard library is used. Embedding the reconstruction material in
+the same package provides obfuscation, not secrecy from someone with the code.
+This implementation is scoped to small, locally generated credential bundles.
+"""
+
+import hmac
+import secrets
+import struct
+
+
+_HEADER = b"LMK1"
+_MASK = 0xFFFFFFFF
+
+
+def _rotate(value, count):
+    return ((value << count) | (value >> (32 - count))) & _MASK
+
+
+def _quarter(state, a, b, c, d):
+    state[a] = (state[a] + state[b]) & _MASK
+    state[d] = _rotate(state[d] ^ state[a], 16)
+    state[c] = (state[c] + state[d]) & _MASK
+    state[b] = _rotate(state[b] ^ state[c], 12)
+    state[a] = (state[a] + state[b]) & _MASK
+    state[d] = _rotate(state[d] ^ state[a], 8)
+    state[c] = (state[c] + state[d]) & _MASK
+    state[b] = _rotate(state[b] ^ state[c], 7)
+
+
+def _block(key, nonce, counter):
+    if not isinstance(key, bytes) or len(key) != 32:
+        raise ValueError("Bundle key must contain 32 bytes")
+    if not isinstance(nonce, bytes) or len(nonce) != 12 or not 0 <= counter <= _MASK:
+        raise ValueError("Invalid bundle nonce or counter")
+    initial = list(struct.unpack("<4I", b"expand 32-byte k"))
+    initial += list(struct.unpack("<8I", key)) + [counter] + list(struct.unpack("<3I", nonce))
+    state = initial[:]
+    for _ in range(10):
+        for indices in ((0, 4, 8, 12), (1, 5, 9, 13), (2, 6, 10, 14), (3, 7, 11, 15),
+                        (0, 5, 10, 15), (1, 6, 11, 12), (2, 7, 8, 13), (3, 4, 9, 14)):
+            _quarter(state, *indices)
+    return struct.pack("<16I", *[(value + original) & _MASK for value, original in zip(state, initial)])
+
+
+def _crypt(key, nonce, data):
+    output = bytearray()
+    for counter, offset in enumerate(range(0, len(data), 64), 1):
+        stream = _block(key, nonce, counter)
+        output.extend(value ^ stream[index] for index, value in enumerate(data[offset:offset + 64]))
+    return bytes(output)
+
+
+def _poly1305(data, key):
+    if len(key) != 32:
+        raise ValueError("Invalid bundle authenticator key")
+    r = int.from_bytes(key[:16], "little") & 0x0FFFFFFC0FFFFFFC0FFFFFFC0FFFFFFF
+    s = int.from_bytes(key[16:], "little")
+    accumulator = 0
+    for offset in range(0, len(data), 16):
+        value = int.from_bytes(data[offset:offset + 16] + b"\x01", "little")
+        accumulator = (accumulator + value) * r % ((1 << 130) - 5)
+    return ((accumulator + s) % (1 << 128)).to_bytes(16, "little")
+
+
+def _tag(key, nonce, ciphertext, associated):
+    mac_data = associated + bytes((-len(associated)) % 16)
+    mac_data += ciphertext + bytes((-len(ciphertext)) % 16)
+    mac_data += struct.pack("<QQ", len(associated), len(ciphertext))
+    return _poly1305(mac_data, _block(key, nonce, 0)[:32])
+
+
+def _encrypt(key, nonce, plaintext, associated):
+    ciphertext = _crypt(key, nonce, plaintext)
+    return ciphertext + _tag(key, nonce, ciphertext, associated)
+
+
+def _decrypt(key, nonce, encrypted, associated):
+    if len(encrypted) < 16:
+        raise ValueError("Truncated credential bundle")
+    ciphertext, tag = encrypted[:-16], encrypted[-16:]
+    if not hmac.compare_digest(tag, _tag(key, nonce, ciphertext, associated)):
+        raise ValueError("Credential bundle authentication failed")
+    return _crypt(key, nonce, ciphertext)
+
+
+def seal_credentials(certificate, private_key, key):
+    if len(certificate) not in (281, 285) or not 1 <= len(private_key) <= 2048:
+        raise ValueError("Unsupported credential bundle lengths")
+    # Every generated module uses a newly generated key and random nonce.
+    nonce = secrets.token_bytes(12)
+    payload = struct.pack("<HH", len(certificate), len(private_key)) + certificate + private_key
+    return _HEADER + nonce + _encrypt(key, nonce, payload, _HEADER)
+
+
+def open_credentials(bundle, key):
+    if not isinstance(bundle, bytes) or not 36 <= len(bundle) <= 4096 or bundle[:4] != _HEADER:
+        raise ValueError("Unsupported encrypted credential bundle")
+    payload = _decrypt(key, bundle[4:16], bundle[16:], _HEADER)
+    if len(payload) < 4:
+        raise ValueError("Truncated credential bundle payload")
+    certificate_size, key_size = struct.unpack_from("<HH", payload)
+    if certificate_size not in (281, 285) or not 1 <= key_size <= 2048:
+        raise ValueError("Unsupported credential bundle payload lengths")
+    if len(payload) != 4 + certificate_size + key_size:
+        raise ValueError("Credential bundle payload length mismatch")
+    return payload[4:4 + certificate_size], payload[4 + certificate_size:]

ciplink/_logix_metadata_bundle.py

@@ -0,0 +1,32 @@
+"""Generated sealed metadata credentials; reversible local obfuscation."""
+import base64
+from ._logix_bundle_codec import open_credentials
+
+_BLOCKS = (
+    'uaqeVqRwHD{(Pv`t8{p18+Ns)I{x!*bl9t_JYMB(J!4Db0yCX9w$~#rtGCaOc2D}LS6-Hc7JA5V?MTy3',
+    'WnlPK!dQ?a@Lc%_Q;;?D#yWb7(`_cz(0LHa`wOD}pi47y(bjL~qRPX{gQ<Sla`V;ESNVb4T5tP+A8@pD',
+    'Zh={^oB%8nb}HGn`Z%`(^hH6*uykD3k7(393&gMx31A4n7Qt}@rTA6_!3;n&aIB`{lWwua3*XPgFH;w&',
+    'lD4?s!V{j7V1L|*^o~*M6#(+<=&Ww#I5s5{NSDR)?X+Znb`R~H_1@KqmImMr_AtDMGW+?C-ul94W0k=W',
+    'HhqnsTL5Ja3Pc()RgO6DnjkPVw)}}L*3TsWcqWsJR$`i(Z+}e9rE2HR_Q(i`XnRDLuz=qTAVw&N`+tFG',
+    '#{rU1Xzt#6VS+T&(8haBVoad{NOiGf>6UVQuOw|&j=<i54tpAH57erNlot80>4Slr<uvK*1RyOA)$L?<',
+    'ppCpehcU8oE&z?NdliNMd_5(`G!;YVXZk+aZ3z|sXy_XW+X4qs(HmXV{Czf|LDY|;jrbXOp-GY',
+    'RfWq&wx%QCsGonx{zGhJ>>PaY<ZgK*_)Iy<H{c`fTQFK^v>1>DNA^$kD|){Y><yCaqqXWQ>-%Xu6jFPq',
+    'W|3nui(P|@bfl|YBwmy@;A*~D$!&}Wr|Q1Fcr`R*RG}`zlC{XiecE%qV9lnrz+bfb+9rOM#Y%Kk$Pt`A',
+    '1}WV_H_Qr4rsq;qLO&EWm-IxBx*PciRnkQhOM>QGqo{`qL>8N9H*?zLx=uaXBXyMv6U;CEw_oa{;0noX',
+    '5QHE~fIbVVJbZ#o56uf0ukhyxvBs{GAa0}aCqyvAY5?C!_sxPb*Tjj`IK(HV%_f~3MCLSmxK24cZ@NTV',
+    'Wk_(8D6U8VB)2zqk}Sw`hicb|#;4(F(T_lF)IRGqI^oW<D@|Ce0D1yf&X3eW&#31(HClM$Q)ymS*RnDv',
+    'Bi3)|iETOD-{H%c8WLbOGDNG~!Jr^u^FC<Jj=V-5h;|B`x`T|#Bn-`WlhR=mu=&x9Z)TbN+w+8md!Htd',
+    'OifEM@QpPieJZHH*^_REvjG(hz}K9sgdV~ul{*}28zy{m0ujl$zE@%>pB{)|Wt^D_*nBT~i+?QqI9^%(',
+    'eRw^ruoMDOPHs4&x{(B3q_!|Xbdzkz@B$BS<0Ppb<2)vvi*NW7K#_=hn38NBmU$a_jx$0kYzYV{*D&<V',
+)
+_ORDER = (13, 5, 9, 11, 12, 8, 1, 14, 3, 4, 7, 2, 10, 0, 6)
+_MATERIAL = ('E-Lv+FnW<bcnV%ny0NhTiye<vXOaO{FaR@DzcZc!', 'CYm@FlgeeOr&|F6RJY7%=n@^Y{z4%`lAmSv`RY+j', 'hzSY`vL^W4+xT?7LCM>9jZcVavq)T>l%~;w<BX@j')
+
+
+def load():
+    data = base64.b85decode("".join(_BLOCKS[index] for index in _ORDER))
+    parts = [base64.b85decode(value) for value in _MATERIAL]
+    if len(parts) != 3 or any(len(part) != 32 for part in parts):
+        raise ValueError("Invalid bundled credential material")
+    material = bytes(a ^ b ^ c for a, b, c in zip(*parts))
+    return open_credentials(data, material)

ciplink/_version.py

@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*-
+#
+# Copyright (c) 2021 Ian Ottoway <ian@ottoway.dev>
+# Copyright (c) 2014 Agostino Ruscito <ruscito@gmail.com>
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+#
+
+__version__ = "0.1.0"
+__version_info__ = tuple(int(x) for x in __version__.split("."))

ciplink/cip/__init__.py

@@ -0,0 +1,29 @@
+# -*- coding: utf-8 -*-
+#
+# Copyright (c) 2021 Ian Ottoway <ian@ottoway.dev>
+# Copyright (c) 2014 Agostino Ruscito <ruscito@gmail.com>
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+#
+
+from .data_types import *
+from .object_library import *
+from .services import *
+from .status_info import *
+from .pccc import *